Benign javascript Download

@angulra/core 1.0.67

“Core Libs”

Framework scope spelling variant executes archived remote code at installnpm preinstall executes replayed third-party code through Node stdin
SHA-256d60186fa20855b91536b11a655c4ac1dbccdf5975826313b8f246d6c4e285e70
URLhttps://repo.huaweicloud.com/repository/npm/@angulra/core/-/core-1.0.67.tgz
MaleculeO₂(CS)H₆(Cm₃₈CrDb₂₂FOs₆Po₇)Md₄(In₇Pa₁₁Pt)

Also flagged by osm (src/package/package.json:36 defines a preinstall script that downloads a remote script from gitflic.ru (via web.archive.org cloaking) and pipes it directly into `node`, executing arbitrary attacker-co…), osv (MAL-2026-17496: Malicious code in @angulra/core (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.